How should I use these Endpoint Protection practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Endpoint Protection questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Endpoint Protection domain.

CND · topic practice

Endpoint Protection practice questions

Practise EC-Council Certified Network Defender (CND, 312-38, Blueprint v4.0) (CND) Endpoint Protection practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Endpoint Protection

Practice 10 questions Browse domain →

What the exam tests

What to know about Endpoint Protection

IPv6 questions usually test address types (link-local, global unicast, ULA), autoconfiguration (SLAAC), Neighbor Discovery Protocol and the differences from IPv4.

IPv6 address types and their scopes (link-local, global unicast, multicast, ULA).

SLAAC vs DHCPv6 vs stateful assignment.

Neighbor Discovery Protocol replacing ARP.

IPv6 routing differences and dual-stack coexistence.

Watch out for

Common Endpoint Protection exam traps

▸Link-local addresses are not routable beyond the local link.
▸SLAAC uses EUI-64 or random interface IDs — not a DHCP server.
▸NDP uses ICMPv6, not ARP.
▸An IPv6 prefix is /64 for most host subnets, not /24.

Practice set

Endpoint Protection questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Endpoint Protection explanation →

An Incident Responder analyzing a compromised Linux server suspects a rootkit has modified system binaries. The responder runs the package manager verification command on Debian/Ubuntu to check installed packages against the package database. Which command is appropriate?

Trap 1: rpm -Va

rpm -Va is used on RPM-based systems (RedHat/CentOS), not Debian/Ubuntu.

Trap 2: debsums -ac

While debsums checks sums, dpkg --verify is the native dpkg suite tool for comprehensive file state verification.

Trap 3: apt-get check-integrity

apt-get check-integrity is not a valid apt-get command; apt verifies dependency graphs.

Study all Endpoint Protection common traps →

A
dpkg --verify
dpkg --verify (or dpkg -V) checks files installed by packages against the database to detect modifications.
B
rpm -Va
Why wrong: rpm -Va is used on RPM-based systems (RedHat/CentOS), not Debian/Ubuntu.
C
debsums -ac
Why wrong: While debsums checks sums, dpkg --verify is the native dpkg suite tool for comprehensive file state verification.
D
apt-get check-integrity
Why wrong: apt-get check-integrity is not a valid apt-get command; apt verifies dependency graphs.

Endpoint Protection practice questions

What to know about Endpoint Protection

Common Endpoint Protection exam traps

Endpoint Protection questions

An Incident Responder analyzing a compromised Linux server suspects a rootkit has modified system binaries. The responder runs the package manager verification command on Debian/Ubuntu to check installed packages against the package database. Which command is appropriate?

An organization's Endpoint Detection and Response (EDR) platform flags a suspicious PowerShell command line executing an encoded script block. Which Windows logging subsystem should the security analyst inspect for the decoded script contents?

A security engineer is configuring mobile device management (MDM) for corporate-owned iOS devices. To prevent users from installing unauthorized apps while still allowing access to enterprise applications, which feature should be deployed?

A security analyst is preparing to harden a fleet of corporate Windows 10 endpoints against pass-the-hash attacks. Which built-in Windows feature should be enabled and configured to isolate LSASS memory using virtualization?

An enterprise environment uses Microsoft Endpoint Configuration Manager (MECM) for patch management. An administrator needs to ensure that critical patches are installed on workstations with minimal user disruption outside of active hours. Which MECM feature should be configured?

An administrator needs to enforce mandatory password complexity, minimum length, and account lockout policies for local user accounts on standalone Windows Server endpoints that are not joined to an Active Directory domain. Which tool should be used?

A security administrator needs to configure Windows Defender Firewall with Advanced Security via Group Policy Object (GPO) to block all outbound connections except those explicitly permitted by a rule. Where should the administrator configure this setting?

An IoT device deployed in an industrial environment runs a minimal Linux kernel and needs its attack surface reduced by disabling unnecessary kernel modules like USB storage and Bluetooth. Where should the administrator configure module blacklisting?

A security architect is configuring Linux Unified Key Setup (LUKS) disk encryption on enterprise laptops. To ensure that the encryption key can be decrypted automatically during boot via a Trusted Platform Module (TPM) 2.0 chip without manual passphrase entry, which tool should be integrated?

A security administrator is evaluating Mobile Threat Defense (MTD) solutions for corporate Android devices. The administrator needs a solution that can detect rogue Wi-Fi access points and Man-in-the-Middle (MitM) attacks at the network layer. Which capability must the MTD solution provide?

An enterprise endpoint security policy requires that all USB mass storage devices be blocked on workstations, while allowing encrypted company-issued smart cards and input devices. Which configuration approach should an administrator take using Group Policy?

A system administrator is hardening a fleet of Linux servers by setting strict umask values for all users to ensure newly created files are not readable by others. Where should this default system-wide umask be configured?

An Incident Response team is investigating a Linux server where a persistent backdoor is suspected of hiding process IDs (PIDs) using user-space hooks. Which utility should the responder use to compare process lists returned by the kernel system call table against direct kernel memory inspection?

An administrator wants to ensure that critical system files on Windows endpoints are automatically monitored for unauthorized modifications and that any changes trigger an alert. Which built-in Windows tool or feature should be utilized?

A security engineer is configuring Linux Auditd on enterprise servers to log all attempts to modify user and group databases. Which audit rule should be added to /etc/audit/audit.rules?

An organization is hardening Android enterprise devices and wants to prevent users from installing applications from unknown sources while ensuring corporate apps update automatically. Which policy configuration in the EMM/MDM console achieves this?

A security analyst is investigating an EDR alert where a process spawned a suspicious child process. The analyst needs to review the process lineage tree. Which EDR capability is most useful for this task?

Track your progress over time

Start a Endpoint Protection only practice session

Related CND topic practice pages

Endpoint Protection practice questions

Enterprise Cloud Virtual And Wireless Network Protection practice questions

Network Security Controls Protocols And Devices practice questions

Incident Detection Response And Threat Prediction practice questions

Network Attacks And Defense Strategies practice questions

Network Defense Management practice questions

Application And Data Protection practice questions

Network Perimeter Protection practice questions

CND fundamentals practice questions

CND scenario practice questions

CND troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid